We do not answer the questions, here we will give some indication of use of Xplico.

The “Ann’s AppleTV” pcap file has no particular problems of decoding, in fact if you process the pcap you obtain the data represented in the two pictures below.

For the “Forensic Challenge 2010 – pcap attack trace” pcap decoding requires more attention. In fact this pcap file has corrupted packet (and not retransmitted), so you must disable the Xplico checksum verification (HowTo).

From cli the command is:

./xplico -c config/xplico_cli_nc.cfg -m pcap -f attack-trace.pcap

Since Xplico is able to recognize the protocols (not all) even if they use non-standard ports is easy to see what protocol was used and which data file was downloaded.
In the figure below there is the result of decoding with XI.

At SourceForge there is a VirtualBox.org image of Debian 5.0 with Xplico 0.5.2 installed and running. It is a smart way for testing this software without altering your environment. It is just download and begin to test Xplico. You can use Xplico to decode traffic in console or via web, uploading your own traffic pcap files. Click here to download it.

For some time we have in mind to make available a Wiki that contains the documentation of Xplico. Soon the new Wiki will be available, even if initially it will not have much contents.

Merit and initiative of Carlos Gacimartín also a Forum will be opened. Thanks to Carlos, who has offered to maintain and administer the Forum, the Forum will allow participants to share: suggestions, use and problems concerning Xplico.
In the website of Carlos you can find also a useful help for the problem of installing the package .deb for Ubuntu 9.04.